The default permissions for Endymion MailMan allow local users to read email or modify files.
endymion mailman webmail 3.0.18